正式なドキュメントは英語版であり、この日本語訳はAI支援翻訳により作成された参考用のものです。日本語訳の一部の内容は人間によるレビューがまだ行われていないため、翻訳のタイミングにより英語版との間に差異が生じることがあります。最新かつ正確な情報については、英語版をご参照ください。

GitLab Advanced SAST rules: PHP

  • Tier: Ultimate
  • Offering: GitLab.com, GitLab Self-Managed, GitLab Dedicated

Rules used by GitLab Advanced SAST to detect vulnerabilities in PHP code.

Rule IDRule descriptionCWEOWASP Top 10Status
php-doctrine-sqli-dbal-taintImproper neutralization of special elements used in an SQL command (‘SQL Injection’)CWE-89A1:2017, A03:2021N/A
php-doctrine-sqli-orm-taintImproper neutralization of special elements used in an SQL command (‘SQL Injection’)CWE-89A1:2017, A03:2021N/A
php-lang-accesscontrol-phpinfo-atomicExposure of sensitive system information to an unauthorized control sphereCWE-497A5:2017, A01:2021N/A
php-lang-cmdi-taintImproper neutralization of special elements used in an OS command (‘OS Command Injection’)CWE-78A1:2017, A03:2021N/A
php-lang-codei-taintImproper control of generation of code (‘Code Injection’)CWE-94A1:2017, A03:2021N/A
php-lang-crypto-curl-ssl-verification-atomicImproper certificate validationCWE-295A3:2017, A02:2021N/A
php-lang-crypto-ftp-use-atomicCleartext transmission of sensitive informationCWE-319A3:2017, A02:2021N/A
php-lang-crypto-hash-atomicUse of weak hashCWE-328A3:2017, A02:2021N/A
php-lang-crypto-insecure-randomness-atomicUse of cryptographically weak pseudo-random number generator (PRNG)CWE-338A3:2017, A02:2021N/A
php-lang-crypto-mcrypt-cipher-atomicUse of a broken or risky cryptographic algorithmCWE-327A3:2017, A02:2021N/A
php-lang-crypto-mcrypt-cipher-mode-atomicUse of a broken or risky cryptographic algorithmCWE-327A3:2017, A02:2021N/A
php-lang-crypto-mhash-atomicUse of weak hashCWE-328A3:2017, A02:2021N/A
php-lang-crypto-openssl-cipher-atomicUse of a broken or risky cryptographic algorithmCWE-327A3:2017, A02:2021N/A
php-lang-crypto-openssl-hash-atomicUse of weak hashCWE-328A3:2017, A02:2021N/A
php-lang-crypto-openssl-verify-peer-atomicImproper certificate validationCWE-295A3:2017, A02:2021N/A
php-lang-crypto-weak-hash-atomicUse of weak hashCWE-328A3:2017, A02:2021N/A
php-lang-deserialization-taintDeserialization of untrusted dataCWE-502A8:2017, A08:2021N/A
php-lang-ldapi-dn-taintImproper neutralization of special elements used in an LDAP query (‘LDAP Injection’)CWE-90A1:2017, A03:2021N/A
php-lang-ldapi-filter-taintImproper neutralization of special elements used in an LDAP query (‘LDAP Injection’)CWE-90A1:2017, A03:2021N/A
php-lang-misconfiguration-cookie-httponly-atomicSensitive cookie without ‘HttpOnly’ flagCWE-1004A6:2017, A05:2021N/A
php-lang-misconfiguration-cookie-samesite-atomicSensitive cookie with improper SameSite attributeCWE-1275A6:2017, A05:2021N/A
php-lang-misconfiguration-cookie-secure-atomicSensitive cookie in HTTPS session without ‘Secure’ attributeCWE-614A6:2017, A05:2021N/A
php-lang-misconfiguration-session-httponly-atomicSensitive cookie without ‘HttpOnly’ flagCWE-1004A6:2017, A05:2021N/A
php-lang-misconfiguration-session-samesite-atomicSensitive cookie with improper SameSite attributeCWE-1275A6:2017, A05:2021N/A
php-lang-misconfiguration-session-secure-atomicSensitive cookie in HTTPS session without ‘Secure’ attributeCWE-614A6:2017, A05:2021N/A
php-lang-misconfiguration-session-useonlycookies-atomicUse of GET request method with sensitive query stringsCWE-598A6:2017, A05:2021N/A
php-lang-openredirect-taintURL redirection to untrusted site (‘Open Redirect’)CWE-601A01:2021, A5:2017N/A
php-lang-pathtraversal-information-disclosure-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-lang-pathtraversal-medium-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-lang-pathtraversal-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-lang-sqli-inbuilt-libs-taintImproper neutralization of special elements used in an SQL command (‘SQL Injection’)CWE-89A1:2017, A03:2021N/A
php-lang-sqli-inbuilt-libs-two-taintImproper neutralization of special elements used in an SQL command (‘SQL Injection’)CWE-89A1:2017, A03:2021N/A
php-lang-ssrf-buzz-taintServer-side request forgery (SSRF)CWE-918A1:2017, A10:2021N/A
php-lang-ssrf-curl-taintServer-side request forgery (SSRF)CWE-918A1:2017, A10:2021N/A
php-lang-ssrf-functions-taintServer-side request forgery (SSRF)CWE-918A1:2017, A10:2021N/A
php-lang-ssrf-guzzle-taintServer-side request forgery (SSRF)CWE-918A1:2017, A10:2021N/A
php-lang-ssrf-httpful-taintServer-side request forgery (SSRF)CWE-918A1:2017, A10:2021N/A
php-lang-ssrf-reactphp-taintServer-side request forgery (SSRF)CWE-918A1:2017, A10:2021N/A
php-lang-xss-stored-one-taintImproper neutralization of input during web page generation (‘Cross-site Scripting’)CWE-79A1:2017, A03:2021N/A
php-lang-xss-stored-two-taintImproper neutralization of input during web page generation (‘Cross-site Scripting’)CWE-79A1:2017, A03:2021N/A
php-lang-xss-taintImproper neutralization of input during web page generation (‘Cross-site Scripting’)CWE-79A1:2017, A03:2021N/A
php-lang-xxe-domdocument-taintImproper restriction of XML external entity referenceCWE-611A4:2017, A05:2021N/A
php-lang-xxe-domdocument-xinclude-taintImproper restriction of XML external entity referenceCWE-611A4:2017, A05:2021N/A
php-lang-xxe-simplexml-taintImproper restriction of XML external entity referenceCWE-611A4:2017, A05:2021N/A
php-lang-xxe-xmldocument-taintImproper restriction of XML external entity referenceCWE-611A4:2017, A05:2021N/A
php-lang-xxe-xmlreader-taintImproper restriction of XML external entity referenceCWE-611A4:2017, A05:2021N/A
php-laravel-cmdi-taintImproper neutralization of special elements used in an OS command (‘OS Command Injection’)CWE-78A1:2017, A03:2021N/A
php-laravel-misconfiguration-cookie-httponly-atomicSensitive cookie without ‘HttpOnly’ flagCWE-1004A6:2017, A05:2021N/A
php-laravel-misconfiguration-cookie-samesite-atomicSensitive cookie with improper SameSite attributeCWE-1275A6:2017, A05:2021N/A
php-laravel-misconfiguration-cookie-secure-atomicSensitive cookie in HTTPS session without ‘Secure’ attributeCWE-614A6:2017, A05:2021N/A
php-laravel-misconfiguration-session-httponly-atomicSensitive cookie without ‘HttpOnly’ flagCWE-1004A6:2017, A05:2021N/A
php-laravel-misconfiguration-session-samesite-atomicSensitive cookie with improper SameSite attributeCWE-1275A6:2017, A05:2021N/A
php-laravel-misconfiguration-session-secure-atomicSensitive cookie in HTTPS session without ‘Secure’ attributeCWE-614A6:2017, A05:2021N/A
php-laravel-openredirect-taintURL redirection to untrusted site (‘Open Redirect’)CWE-601A01:2021, A5:2017N/A
php-laravel-pathtraversal-file-facade-information-disclosure-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-laravel-pathtraversal-file-facade-medium-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-laravel-pathtraversal-file-facade-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-laravel-pathtraversal-request-response-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-laravel-pathtraversal-storage-facade-information-disclosure-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-laravel-pathtraversal-storage-facade-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-laravel-pathtraversal-view-facade-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-laravel-sqli-column-one-taintImproper neutralization of special elements used in an SQL command (‘SQL Injection’)CWE-89A1:2017, A03:2021N/A
php-laravel-sqli-column-two-taintImproper neutralization of special elements used in an SQL command (‘SQL Injection’)CWE-89A1:2017, A03:2021N/A
php-laravel-sqli-raw-queries-taintImproper neutralization of special elements used in an SQL command (‘SQL Injection’)CWE-89A1:2017, A03:2021N/A
php-laravel-ssrf-taintServer-side request forgery (SSRF)CWE-918A1:2017, A10:2021N/A
php-laravel-ssti-taintImproper neutralization of special elements used in a template engineCWE-1336A1:2017, A03:2021N/A
php-laravel-xss-stored-one-taintImproper neutralization of input during web page generation (‘Cross-site Scripting’)CWE-79A1:2017, A03:2021Added 2026-02-17
php-laravel-xss-stored-two-taintImproper neutralization of input during web page generation (‘Cross-site Scripting’)CWE-79A1:2017, A03:2021Added 2026-02-17
php-laravel-xss-taintImproper neutralization of input during web page generation (‘Cross-site Scripting’)CWE-79A1:2017, A03:2021N/A
php-smarty-ssti-taintImproper neutralization of special elements used in a template engineCWE-1336A1:2017, A03:2021N/A
php-symfony-cmdi-taintImproper neutralization of special elements used in an OS command (‘OS Command Injection’)CWE-78A1:2017, A03:2021N/A
php-symfony-codei-taintImproper control of generation of code (‘Code Injection’)CWE-94A1:2017, A03:2021N/A
php-symfony-deserialization-taintDeserialization of untrusted dataCWE-502A8:2017, A08:2021N/A
php-symfony-deserialization-yaml-taintDeserialization of untrusted dataCWE-502A8:2017, A08:2021N/A
php-symfony-misconfiguration-cookie-httponly-atomicSensitive cookie without ‘HttpOnly’ flagCWE-1004A6:2017, A05:2021N/A
php-symfony-misconfiguration-cookie-samesite-atomicSensitive cookie with improper SameSite attributeCWE-1275A6:2017, A05:2021N/A
php-symfony-misconfiguration-cookie-secure-atomicSensitive cookie in HTTPS session without ‘Secure’ attributeCWE-614A6:2017, A05:2021N/A
php-symfony-misconfiguration-session-httponly-atomicSensitive cookie without ‘HttpOnly’ flagCWE-1004A6:2017, A05:2021N/A
php-symfony-misconfiguration-session-samesite-atomicSensitive cookie with improper SameSite attributeCWE-1275A6:2017, A05:2021N/A
php-symfony-misconfiguration-session-secure-atomicSensitive cookie in HTTPS session without ‘Secure’ attributeCWE-614A6:2017, A05:2021N/A
php-symfony-openredirect-taintURL redirection to untrusted site (‘Open Redirect’)CWE-601A01:2021, A5:2017N/A
php-symfony-pathtraversal-filesystem-information-disclosure-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-symfony-pathtraversal-filesystem-medium-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-symfony-pathtraversal-filesystem-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-symfony-pathtraversal-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-symfony-pathtraversal-uploadedfile-taintImproper limitation of a pathname to a restricted directory (‘Path Traversal’)CWE-22A5:2017, A01:2021N/A
php-symfony-ssrf-taintServer-side request forgery (SSRF)CWE-918A1:2017, A10:2021N/A
php-symfony-ssti-taintImproper neutralization of special elements used in a template engineCWE-1336A1:2017, A03:2021N/A
php-symfony-xss-stored-taintImproper neutralization of input during web page generation (‘Cross-site Scripting’)CWE-79A1:2017, A03:2021N/A
php-symfony-xss-stored-two-taintImproper neutralization of input during web page generation (‘Cross-site Scripting’)CWE-79A1:2017, A03:2021N/A
php-symfony-xss-taintImproper neutralization of input during web page generation (‘Cross-site Scripting’)CWE-79A1:2017, A03:2021N/A
php-symfony-xss-twig-autoescape-atomicImproper neutralization of input during web page generation (‘Cross-site Scripting’)CWE-79A1:2017, A03:2021N/A